CVE-2026-14297

CVE-2026-14297 is an out-of-bounds write (CWE-787) in the Bluetooth Continuous Glucose Monitoring Service (CGMS) Record Access Control Point (RACP) write handler, where attacker-controlled data is copied into a fixed 20-byte static buffer without sufficient bounds checking. An authenticated BLE peer — a device connected over Bluetooth Low Energy within radio range — can send a crafted RACP write that overflows the buffer into adjacent BSS memory. The impact is not predetermined: because the overflow lands in linker-assigned BSS memory, its effect depends entirely on the specific firmware build's memory layout, ranging from harmless corruption of adjacent variables to crashes or exploitable corruption, which is why CVSS 4.0 rates it 8.7 High with high confidentiality, integrity and availability impact. Affected are devices whose firmware implements the CGMS RACP write handler in this way; the available data does not name a specific vendor, product, or version range, so operators of BLE-connected continuous glucose monitoring devices should check with their device and Bluetooth stack vendors. No exploitation has been reported: there is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS assigns a 0.2% probability of exploitation within 30 days (5th percentile).

What to do: No patched version is identified in the available data; contact your CGM device vendor and Bluetooth stack supplier to determine whether your firmware includes the vulnerable CGMS RACP write handler and request an updated release addressing CVE-2026-14297. As interim mitigation, limit BLE exposure: keep CGM sensors, pumps, and receivers out of range of untrusted Bluetooth devices, require pairing/authentication, and disable the CGM service when not in use. Because impact varies with each build's memory layout, prioritize confirmation and patching for devices where adjacent BSS variables could affect dosing or device availability.